> For the complete documentation index, see [llms.txt](https://docs.keystonefi.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keystonefi.xyz/how-it-works/whitepaper.md). # Whitepaper {% hint style="info" %} **TL;DR** Keystone holds jitoSOL and shorts the same amount of SOL on Phoenix, so staking yield arrives in dollars. Both legs move in one transaction. When the hedge costs more than it earns, it closes and parks in USDC lending. Backtest on Phoenix's own funding, 2025-11-19 to 2026-09-30: **7.19% net, −0.314% max drawdown**. {% endhint %} *Keystone Finance · Whitepaper v2.0 · 13 October 2026 · Kamran Choudhry* *** ## ksUSD turns SOL staking into dollar yield Deposit USDC. Keystone buys staked SOL and shorts the same amount of SOL perp. Price risk cancels down to a small residual, and the staking yield is what is left. You hold a vault share, not a pegged dollar: your balance is fixed, and the share price rises as that yield accrues — and can fall. Nothing is emitted, nothing sits off-chain, and every position is verifiable on Solana. **One program · one vault · one share mint.** | Where the yield comes from | Net APY | Across 2.00–5.50% staking (§VII) | Floor | Max drawdown | | ------------------------------------------------------------------------------------------------------------------------- | ----------------------- | -------------------------------- | ------------------ | ------------------------------ | | jitoSOL staking on \~82% of NAV while hedged, plus funding on the short, less the \~22% of funding spent on mode switches | **7.19%** (7.84% gross) | 5.61% to 7.24% | 4.51% USDC lending | **−0.314%** (316-day backtest) | **Status: pre-deployment.** v1 hedges on Phoenix Perps (Ellipsis Labs) with USDC margin via the Ember program; jitoSOL is held unlevered as the spot leg. Devnet only, audit pending. Phoenix's SOL perp opened 18 November 2025, so the backtest window is the venue's entire life to its last complete month: 316 days of its own funding, unscaled. That is a young venue's record, not a market cycle. ## I. Where the yield comes from Almost every yield-bearing dollar on-chain is, underneath, a bet on perp funding. This one parks when funding turns, so its floor is the lending rate, not funding's cycle. Funding is the obvious thing to build on, and the first thing to go when you need it. Ethena showed both halves: sUSDe rode positive funding to around 15% through 2025, then settled back to 3.7% as funding compressed.¹ Build a dollar on funding and you inherit funding's cycle. Here, staking pays for the conversion and funding decides when it is worth running. Fully hedged, per $100 of NAV per year: | Leg | Per year | | ------------------------------------------------------------ | ----------- | | $81.8 of jitoSOL @ 4.94% staking | **+$4.04** | | $8.2 of USDC margin at Phoenix @ 0% | $0.00 | | $8.0 of redemption buffer, lent @ 4.51% | +$0.36 | | $2.0 of buffer held raw for instant redemption | $0.00 | | Funding on the short, at the +8.68% its hedged days averaged | +$7.10 | | Perp fees, charged per day held | −$0.08 | | **Hedged run rate** | **+$11.42** | That is the rate while the position is on. The vault is hedged a little over half the time, earns 4.42% parked the rest, and pays $0.92 a year to move between modes, which takes the run rate down to the 7.84% gross. Phoenix has averaged **+3.49% APR** since inception, positive on 62.8% of days. It also swings from −14% to +22% by month, and reacting to those swings gives back 22% of what the vault collects. The $7.10 is high because the vault parks when funding turns; the days it sat out averaged −3.57%. Switch each leg off in the backtest to see what it contributes. With funding off, Keystone never hedges and earns lending, **4.52%**. With staking off, funding alone nets **5.20%**, 69 bps above lending, mostly on September. Neither leg gets near the combined 7.19%. On this window funding is the larger marginal leg, 267 bps against staking's 199; staking is the one nothing is traded for. Funding pays only if the vault holds through its swings rather than trading them. With the hysteresis band off, the vault nets 3.68%, below the 4.52% it earns with no funding at all, because every move costs 20 bps. That is why the band (below) is worth 351 bps. Funding is the price of leverage on a given venue, paid by whichever side of *its* book is crowded, so Phoenix's cannot be inferred from anyone else's. Over the 316 days both series cover, Phoenix averaged **+3.53%** while Binance averaged **−0.70%**, and the two disagreed on sign for weeks at a time. (The +3.53% is the matched comparison window; the venue's average since it opened, used everywhere else in this paper, is +3.49%.) Phoenix's book is young, and funding arrives with traders. The headline claims only what the venue has already paid. Two things follow: * **The correlation profile differs from both incumbents.** RWA dollars move with the Fed. Ethena moves with the crypto leverage cycle. This moves with Solana network activity. * **Neither yield risk reaches the floor.** Thin funding costs the edge: below the entry gate Keystone parks in USDC lending, where it still earns. A falling staking rate narrows the spread from the other side, and Solana's is on a schedule to fall (§VII). ## II. How it works ### Two modes, one rule Keystone is only ever in one of two states, and the same comparison decides which: | Mode | Position | Earns | | ---------------- | ---------------------------------------------------------------------------- | ---------------------------------- | | **Normal basis** | long jitoSOL spot (unlevered) + short SOL-PERP on Phoenix at 1×, USDC margin | jitoSOL staking + funding received | | **Parked** | all capital in USDC lending (Kamino) | lending yield (4.51%) | jitoSOL is held outright as the spot leg and USDC is posted as perp margin via Ember: no LST is used as perp collateral. Mode switches cost ≈20–40 bps round-trip. There is no reverse mode: harvesting negative funding means borrowing, which adds a borrow surface for very little return. Parked covers negative funding instead, and **v1 never borrows**.
Smoothed perp funding decides the mode: when funding clears the dynamic threshold (+0.12%) Keystone moves to Normal basis (short plus staking); when funding is below it Keystone moves to Parked (USDC lending). Transitions are automatic, driven by the funding signal.

One on-chain signal, smoothed funding, decides the mode.

### When it switches Keystone stays hedged for as long as hedging beats parking. Compare the two on $100: | | Parked | Normal basis | | -------------------- | ------------------ | -------------------------------------------- | | Where the money sits | $90 lent on Kamino | $81.8 in jitoSOL, $8.2 as perp margin | | What it earns | 4.51% on all of it | 4.94% on the $81.8; the margin earns nothing | | **Per year** | **$4.06** | **$4.04** | Hedging starts **$0.02 behind**, so the short has to earn its way in. The short covers $81.8 of SOL, so $0.02 is **0.02%** of it; add the amortized perp round-trip and the break-even lands at **+0.12%**. Funding must clear that before Keystone is better off hedged. That is the whole rule. Not "is funding positive?" but "does the short earn back the gap to parking?" The keeper recalculates that number each cycle from live staking and lending rates, so it moves when they do. **Why the spread matters.** The threshold sits where staking and lending put it, not at zero. Lending has already risen to meet staking: the threshold is positive, and the entry gate above it, +3.12%, sits just under the +3.49% Phoenix has averaged and well over its +1.25% median day. So Keystone hedges only when funding runs hot. That same gap names the failure. The further lending rises, the less often funding clears it, until Keystone is a Kamino deposit carrying the operational risk of a hedged one. A falling staking rate closes the gap from the other side. The keeper measures both rates every cycle because a constant on either side would leave the rule blind to the thing that ends the strategy. **What the floor is set to.** Keystone ships with its on-chain floor at **+12**, the break-even itself, and the keeper can only ever be tighter than the floor, never looser. The program will not open a short below +0.12% funding; the keeper's dynamic rule decides when it actually does. The threshold applies as a ±3-point hysteresis band rather than a line. Keystone opens only once funding clears the threshold by the band (+3.12%), and holds an open short until funding falls below −2.88%. The width is a payback rule: a switch costs 20 bps, and the edge accrues on the 81.8% basis leg, so requiring `(f − f*) × 0.8181 × T/365 > 20 bps` says "only move if the move repays itself within T". At **T = 30 days that is 2.97 points** — the 3.00 in the code. On Phoenix's measured funding the band is worth **351 bps**. Removing it drops net from 7.19% to 3.68%, below lending, because funding swings from −14% to +22% by month and every move costs 20 bps. The band cuts the switches from 22 to 4, which avoids about 416 bps a year of switching cost (18 × 20 bps over 316 days), and gives about 65 bps back in worse mode selection. Without it the vault does not beat lending. Sweeping the width across 0–6 points moves net between 3.68% and 7.19%, and **3 points is the best value tested on this window**; 2 points returns 6.47% and 4 points 7.15%. That it scores best is not evidence for it. The runs differ by up to eighteen switching decisions over 316 days, and every width from 3 points up makes the same four. Fitting a switching parameter on so few events is how a backtest gets optimised into something that does not generalise; the payback rule does not depend on the sample. The [historical simulation](/how-it-works/strategy-and-modes/historical-simulation.md#the-hysteresis-band) carries the full sweep. Transitions run automatically: the smoothed on-chain funding signal decides, a keeper bot executes, and a 7-day mean plus a 12-hour minimum hold filter out the noise. See [Strategy & Modes](/how-it-works/strategy-and-modes.md#when-does-the-vault-turn-the-trade-on). ### Near zero, not zero Three things stop the legs cancelling exactly. The spot leg is jitoSOL while the short is SOL-PERP, so they offset only while the jitoSOL/SOL ratio holds; a depeg is a straight loss. Delta drifts inside a 25 basis point band between rebalances. A correction is bounded four ways: that band, a per-call clip, the position cap, and the collateral posted at the venue, since a short can only be as large as its margin carries. And the perp can trade away from spot, with the position marked against the perp. Staking accrual is not a fourth item, because it is hedged rather than carried. The appreciation *is* the yield: jitoSOL gains about 4.94% a year against SOL, and leaving that alone would leave the return denominated in SOL rather than dollars. A resize sells it forward each time the drift passes the band, roughly every two and a half weeks. None of the three that remain is large in ordinary conditions. Together they are still enough that "no price risk" would be the wrong claim. See [Risk](/start-here/volatility-risk-management.md). ### What the conversion costs Every dollar posted as margin is a dollar not earning staking yield. At v1 sizing about **9.1% of deployed capital sits at Phoenix as USDC margin earning nothing**, which is about 8.2% of NAV, against 81.8% in jitoSOL earning the staking rate. A further 10% of NAV is the redemption buffer: 8% lent on Kamino, 2% held raw. That allocation is already inside every net figure here: the staking leg contributes $4.04 of the $11.42 hedged run rate. The obvious dismissal is that this is a hedged jitoSOL wrapper. The difference shows up when funding inverts. A naive hedged LST keeps paying to hold its short and bleeds; ksUSD closes and parks in USDC lending. That exit costs 20–40 bps, is written into the program, and runs automatically on a signal nobody has to interpret. ## III. Why the hedge is the product The hedge performs the conversion, so anything that can break the hedge breaks the product. That isn't a risk sitting beside the design; it is a hole in it. A venue that halts trading, or auto-deleverages a profitable short to cover someone else's loss, doesn't give ksUSD a bad day. It removes the leg that makes the yield a *dollar* yield, while Keystone still holds the jitoSOL. So the venue choice carries weight rather than being a footnote. Phoenix settles on-chain. The vault opens, defends and closes its own hedge by calling the program directly, the position is visible on Solana, and no operator sits in between. That doesn't remove venue risk (§VIII is specific about what remains), but it puts the mechanism somewhere it can be inspected, which is the minimum you should want from the thing the product depends on. ## IV. The share, and what it costs ksUSD is a **non-rebasing** share token. Your balance stays fixed and the share price rises as carry accrues. Redemption is against NAV, instant from the liquidity buffer and queued for larger size. It is a share in a hedged carry vault, not a dollar-pegged stablecoin. No fixed yield, no RWA, no emissions, no view on where SOL goes. The architecture is small on purpose: one program, one vault, one rule set. | Yield source | Active when | Contribution | | ------------------- | ----------------------- | ---------------------------------------------------------------- | | **jitoSOL staking** | Normal basis (spot leg) | **4.94% APR** | | Phoenix funding | Normal basis | −14% to +22% by month; **+3.49% average** since the venue opened | | USDC lending | Buffer + parked | 4.51% APR | | Fee | Rate | | ----------- | -------------------------------- | | Management | **0%** | | Performance | **20%, and only above a hurdle** | | Withdrawal | **0%** | **The floor is a Kamino deposit; the upside is 80% of everything above it.** The hurdle is the USDC lending rate — what the same capital would earn sitting in Kamino by itself — so the performance fee applies only to what Keystone adds on top. A year that returns exactly the hurdle costs nothing, so the fee cannot drag a holder under the benchmark. Above it, they keep 80 cents of every dollar of edge. Parked mode is why this matters. Parked, Keystone *is* a Kamino USDC deposit: no perp, no hedge, nothing the holder couldn't do themselves in a single transaction. Taking a fifth of that return would be charging a performance fee for holding a deposit, and it would leave a parked holder behind where they'd have been lending the USDC directly. The hurdle gives those days' yield back in full, so the fee starts only where the strategy does. Across the backtest window it is worth 96 bps a year to the holder: a flat 20% would take net from 7.19% to 6.23%. The rate isn't fixed in code. The hurdle is read from Kamino's live supply APY at deploy and maintained against the smoothed rate afterwards. See [Fees](/start-here/fees.md). ## V. Why this only assembles on Solana The design needs four things on one chain, close enough together to compose: * **An on-chain perp.** Keystone opens its hedge by calling into Phoenix Perps with USDC margin from its own program. Phoenix settles on-chain, and that direct call is the part that doesn't port. * **Funding it receives**, rather than a pool borrow-fee it pays. * **A high-yield LST and deep USDC lending.** jitoSOL held unlevered as the spot leg; Kamino for the liquidity buffer and parked NAV. * **Fees low enough** that regular rebalancing stays economic. On Ethereum these don't line up. Gas makes rebalancing expensive, the deepest perps sit off-chain or on separate domains, and LST yield, funding and lending live apart from each other. The spot leg also earns more here: Solana staking plus MEV tips leave jitoSOL paying 4.94% after validator commission and Jito's fee, against roughly 3% for Ethereum LSTs. The staking leg is the part of the return nothing is traded for, so that gap matters more than the composability argument does. ## VI. What the backtest shows Daily resolution over every complete month Phoenix has quoted a SOL perp, 2025-11-19 to 2026-09-30. The v1 set, normal plus parked, turned $100 into **$106.19** over 316 days while never giving back more than **0.314%** from a peak. It held the hedge on 57.9% of days and switched modes four times. | Variant | Net APY | Gross APY | $100 net → | Max DD | | ------------------------ | ------------- | --------- | ----------- | --------------------- | | **Normal + parked (v1)** | **7.19%** | 7.84% | **$106.19** | **−0.314%** | | USDC lending benchmark | 4.51% | — | — | flat floor | | sUSDe benchmark | \~3.7% recent | — | — | bleeds in low funding | **The drawdown is the number worth reading, and worth attributing.** February 2026, the month Phoenix funding averaged −14%, closed *positive* — the short is a hedge, not the revenue. The 0.314% is mostly the vault's own trading: hold switching costs at zero and the worst fall is **0.126%**. The worst day in the published run is a mode change rather than a market day, and no month closed negative. That 7.19% is fully loaded. The performance fee, the margin-capital haircut where USDC posted as margin earns nothing, and trading costs are all inside it. Against USDC lending it leaves about 268 bps of edge. **It also leans on one month.** September 2026, +22% funding, is the venue's best month on record and the last in a short window, with the vault hedged through all of it. End the window a month earlier and net is 5.86%; that single month moves the headline by 133 bps. Funding has stayed hot into October, which the window does not include. Don't extrapolate it. ### What the result depends on The window is 316 days, short of a full cycle, so what can be shown is which input the answer rests on. Move the lending benchmark from 3.61% to 5.00% and the edge over lending stays between **246 and 278 bps**. Move the staking rate across what the next three years can plausibly deliver, 5.50% down to 2.00%, and net APY stays between **5.61% and 7.24%**, never below the lending benchmark. That sweep and the schedule behind it are §VII, and staking is the input that decides how long this works. The input the answer is *most* exposed to is what a mode change costs. The model charges 20 bps and the venue retains no historical depth to check it against. At 30 bps net is 6.79% and February closes negative; at 40 bps it is **6.40%**, 189 bps above the lending benchmark, and the drawdown rises to 0.514%. The edge is gone near 85 bps a switch. Both headline numbers move on the same parameter, so a reader who marks the slippage assumption up should discount the drawdown as well as the yield. ### Method Staking runs at jitoSOL's **4.94%** published pool APY: the stake pool's rate, MEV included and net of validator commission and Jito's fee. Solana's 5.30% network rate is not used, because the vault does not receive it. USDC lending runs at Kamino's 4.51% (7-day median, measured 2026-10-13), which parked mode earns and the fee hurdle ratchets at. Funding is Phoenix's own hourly record, unscaled. The mode threshold is the break-even, +0.12%, with a ±3-point band. The perp leg is over-margined well inside the venue's 15× limit, so 8.2% of NAV sits as margin at zero yield. Costs are 5 bps perp fee and 10 bps slippage per side plus 5 bps of swap, 20 bps per switch. Three things the venue's data cannot settle, all cutting the same way. Phoenix is still **gated** (`/v1/view/exchange/status` returns `"gated": true`), so every day in this window is a day we could not have traded. Historical order-book depth is not retained, so nothing supports or refutes the assumption that the hedge was placeable in full each day. And funding is treated as exogenous when at our size it is not: open interest measured 16 September was **$4.73M**, so a fully hedged $500k vault is \~11% of the book, and its own short pushes mark toward index and reduces the funding it collects. Alongside those, 316 days is a young venue's life rather than a cycle. The model also runs a static $100: deposits and redemptions each cost 20 bps and the program charges neither party, so that drag is published beside the headline rather than folded into it. Detail: [historical-simulation.md](/how-it-works/strategy-and-modes/historical-simulation.md). ## VII. The staking runway {% hint style="warning" %} **The short answer.** Disinflation takes the spread, not the floor. Parked, ksUSD earns the lending rate, and net never falls below 5.61% anywhere in the sweep, so the schedule is a yield question rather than a safety one. At today's rates staking alone does not pay for the short, so whether the vault hedges at all is a funding call; on the schedule as passed the edge over lending stays above 110 bps through 2029 on this window's funding, which includes its best month. What narrows is what the vault earns above a Kamino deposit, and the fee that funds Keystone roughly halves. {% endhint %} Staking is the leg nothing is traded for, and Solana's staking rate is on a schedule to fall. **SIMD-0550 passed on 28 August 2026** with 67.001% of participating stake, doubling disinflation from −15%/yr to −30%/yr and pulling the 1.5% terminal rate forward to roughly 2029. Activation is expected in early 2027. Two break-evens follow from the allocation, and they hold regardless of whether any projection is right. Parked earns the lending rate on all but the instant tranche, 4.42%. Hedged earns staking plus funding on the 81.8% basis leg, so the funding the short must earn is `f* = 5.06% − staking`. | Below this jitoSOL rate… | …this stops being true | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **5.06%** | Staking alone justifies the hedge. Under it, the threshold is positive: the short has to earn positive funding before hedging beats parking, so the vault becomes funding-dependent. | | **1.57%** | Average funding is enough. At 1.57% the threshold reaches +3.49%, Phoenix's average since it opened, so under it even an average funding day would not make hedging beat parking, and the vault is in practice a Kamino deposit. | jitoSOL pays **4.94%** today. Mapping the passed schedule onto those lines, at the measured jitoSOL/network ratio of 0.9327: | | Network | jitoSOL | Threshold | | ----- | ------- | --------- | ---------- | | Today | 5.30% | **4.94%** | **+0.12%** | | 2027 | 4.34% | 4.05% | +1.01% | | 2028 | 3.00% | 2.80% | +2.26% | | 2029 | 2.25% | 2.10% | +2.96% | **The first line is already crossed.** jitoSOL pays 4.94% against a 5.06% break-even, so the threshold is positive today and the short has to earn its place. The funding sign therefore already decides whether the hedge goes on at all: the vault is still staking-based, but it is funding-dependent. The second line sits below the 2029 rate; only the 1.5% terminal network rate, about 1.40% jitoSOL, crosses it. Running the backtest across that range, with the threshold re-derived at each step: | jitoSOL | Threshold | Gross | Net | Hedged | Perf fee /$100 | vs lending | | ---------------------------- | ---------- | --------- | --------- | --------- | -------------- | ------------ | | 5.50% | −0.44% | 7.74% | 7.10% | 77.2% | $0.53 | +259 bps | | 5.06% *(break-even 1)* | 0.00% | 7.90% | 7.24% | 57.9% | $0.56 | +273 bps | | **4.94% *****(today)*** | **+0.12%** | **7.84%** | **7.19%** | **57.9%** | **$0.55** | **+268 bps** | | 4.60% | +0.46% | 7.68% | 7.06% | 57.3% | $0.52 | +255 bps | | 4.05% *(2027)* | +1.01% | 6.87% | 6.41% | 55.4% | $0.39 | +190 bps | | 3.50% | +1.56% | 6.59% | 6.20% | 55.1% | $0.34 | +169 bps | | 3.00% | +2.06% | 6.39% | 6.03% | 53.2% | $0.30 | +152 bps | | 2.80% *(2028)* | +2.26% | 5.86% | 5.61% | 35.4% | **$0.21** | **+110 bps** | | 2.10% *(2029)* | +2.96% | 6.22% | 5.90% | 33.2% | **$0.28** | +139 bps | | 2.00% | +3.06% | 6.18% | 5.86% | 32.9% | $0.27 | +135 bps | **Net APY degrades gracefully, and so does the fee.** Parking is a floor, and on this window's funding the edge over lending never drops below 110 bps. The performance fee roughly halves, from $0.55 per $100 to $0.27, because the hurdle ratchets at the lending rate and the gap the fee is charged on narrows from the top. Both outlive the staking decline here, on funding that ends in the venue's best month. Four qualifications. The first three suggest the table is too harsh; the fourth says how far to trust its lower rows: * The projection scales jitoSOL's rate proportionally with the network rate. **MEV is not inflation-linked**, so a growing share of the pool's yield should survive the taper and the tail is understated. How much could not be established: Jito's published MEV series implies 4.48% APR against pool TVL, which cannot sit inside a 4.94% total, so it is not the pool's own share and no decomposition is offered here. * The schedule cuts emissions, and a staker's yield is emissions divided by the staked share, so the cut lands one-for-one only if that share holds at today's 69%. Stake that leaves as the rate falls lifts the yield of what stays. * The lending benchmark is held at 4.51% throughout. If rates fall with staking — and they have historically moved together — the spread closes far more slowly than this. * The low-staking rows are **mode-behaviour dominated**. At those thresholds the vault parks roughly half to two thirds of the time, so those returns turn on a handful of decisions rather than on a stable edge, and they do not fall monotonically. Read them as direction, not as forecast. ## VIII. What can go wrong ### How redemption works Share price is NAV divided by shares, marked from on-chain balances and oracle-priced legs. Deposits and instant withdrawals do not price off a keeper attestation at all: they read the Phoenix trader account and the SOL oracle directly and mark the perp leg themselves, so the number a depositor transacts at is computed from chain state at the moment they transact. Attestation still carries NAV between those moments, bounded by a per-hour change cap and checked against the program's own reading of the position rather than a wide sanity band. A 10%-of-NAV buffer covers normal redemptions instantly. Larger ones burn at the locked price and settle against what the unwind actually realizes, through a permissionless crank. A queued payout in stressed markets can therefore come in below marked NAV. ### Risks **Structural — the ones that can end the conversion** | Risk | Mitigation | | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Hedge removed by the venue** | The one that matters most, per §III. A market halt, or auto-deleveraging that force-closes a profitable short to cover another trader's loss, ends the conversion while Keystone still holds jitoSOL — leaving it long SOL until it can re-hedge or sell. On-chain settlement means Keystone can see and act on this itself, and an emergency unwind can close the spot leg once the market is readable, but neither prevents an ADL. Sizing the short at a small fraction of open interest is the main defence, and it is why the deposit cap tracks the venue rather than demand. | | jitoSOL depeg or slashing | **Marked at market**, via the Pyth jitoSOL/USD feed — so a liquidity discount hits NAV and the share price immediately, not on sale. A discount past the depeg guard, measured against the Jito stake pool's redemption rate, auto-pauses Keystone and arms the emergency unwind. Slashing is unhedgeable, and neither Jito nor any third party reimburses it. | | Smart-contract | Pre-mainnet audit scheduled; devnet only until then. | **Venue & counterparty** | Risk | Mitigation | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Perp-venue dependency | Phoenix is the only hedge venue, so an exploit, outage, or socialized loss hits ksUSD directly. Phoenix is in private beta, and trading needs an Ellipsis capability grant on the vault's trader account, agreed and enabled once the program is on mainnet. A second venue is the structural fix and is not in v1. | | Counterparty | Phoenix, Ember, Kamino, Jupiter, Jito. No single one holds all NAV, but nothing stands in front of a venue failure either — there is no insurance fund, see below. | | Swap router | Jupiter V6 routes every USDC↔jitoSOL swap. Slippage is bounded on-chain. An outage stalls mode rotation; buffer redemptions stay open. | | Oracle | Pyth reads gated by 5-min staleness and 2% confidence; outages past that can still cause loss. | **Yield** | Risk | Mitigation | | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- | | Staking-rate compression | Quantified in §VII: two break-evens, at 5.06% (already crossed) and 1.57% jitoSOL, and the schedule that approaches the second. | | Funding compression | Costs the edge, not the floor. Keystone parks and earns 4.51%; on this window most of the edge above that is funding, and none of it is guaranteed. | **Operational** | Risk | Mitigation | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Liquidation | The short is over-margined and the keeper tops margin up actively — idle USDC first, then a Kamino recall. Both are needed: the jitoSOL sits in Keystone while the margin sits at Phoenix, so the venue cannot see the collateral backing the short. When both sources are exhausted, Keystone de-levers instead: it buys back part of the short and sells the matching fraction of jitoSOL in one transaction, so notional and the collateral requirement fall together and the hedge never opens. Proportional is the whole point — selling jitoSOL alone is the obvious way to raise cash and the one that turns a squeeze into a loss, shrinking the long leg while the short stays whole and leaving Keystone net short into the very rally that caused the shortfall. Anyone may call it once margin falls below the floor, and a caller who is not the keeper may only route the proceeds back to margin — so a stranger can defend the position but cannot drain it. | | Redemption under stress | Buffer and queue absorb normal flow, and a queue larger than both can be funded by de-levering a proportional slice of the position rather than waiting for a mode flip; an extended liquidity drought still lengthens the queue and widens unwind slippage. | | Regime-transition | Mode switches cost 20–40 bps and can mistime fast funding flips; the 7-day mean and 12-hour minimum hold trade a little latency for far less whipsaw. | | Keeper outage | Buffer withdrawals stay open; rotation and queue processing pause until cranking resumes. Anyone can crank. | ### How big are these, in numbers The risk tables above say what can go wrong; these say how much. They come from one stress run on the headline constants. The depeg and bad-month figures use the backtest window; the margin count uses two years of SOL prices, because 316 days is too few to count rare moves. **A jitoSOL discount is the largest unhedged exposure.** The short covers SOL, not jitoSOL, so a discount lands directly on the $81.8 basis leg with nothing offsetting it. The depeg alone, before any cost of trading out: | Discount | NAV impact | | | -------- | ---------- | ------------------------------------------- | | 0.5% | −0.41% | | | 1.0% | −0.82% | | | 2.0% | −1.64% | nearly three months of net yield | | 5.0% | −4.09% | marking NAV auto-pauses, opening hard-fails | | 10.0% | −8.18% | | | 20.0% | −16.36% | | The 5% guard measures against the Jito stake pool's redemption rate rather than against 1.0. That matters: jitoSOL appreciates against SOL as rewards accrue, so a guard anchored at 1.0 would drift out of reach and fire on nothing. Slashing sits underneath all of it and is unhedgeable: Jito runs no insurance fund and nobody reimburses it. **No insurance fund.** There is no reserve standing in front of any of this, and that is a design choice rather than a gap. A reserve sized against market risk would have to be large: a 1% jitoSOL discount costs 0.82% of NAV, and no skim on a 20% performance fee gets near it. A reserve too small to cover an incident is machinery without a purpose. **ksUSD defends no peg.** An insurance fund is what a pegged dollar needs, since a discount there is an existential failure. Here the share price absorbs the shock: NAV is marked at market, the price is designed to be able to fall, and a holder exiting into a bad unwind bears it rather than passing it to the holders who stayed. What Keystone does stand behind is narrower: shortfalls the *protocol* caused rather than the market: a bad fill, an oracle mismark later corrected, an accounting gap. Holders did not sign up for those, and the operator makes them whole from its own fees by sending USDC to the vault, which the share price reflects at the next settle. That needs no instruction and holds no capital idle against an event that has not happened. **How often the short's margin comes under pressure.** The short is the leg that liquidates, so the adverse direction is SOL *up*. Counting intraday highs against the previous close, over 730 days of SOL prices (2024-08-01 to 2026-07-31): | Adverse move | Days | Share | | | ------------ | ---- | ----- | ------------------------------------------------------------------ | | ≥ 3% | 289 | 39.6% | | | ≥ 5% | 139 | 19.0% | about half the entry margin; where a maintenance requirement bites | | ≥ 9% | 27 | 3.7% | exhausts the entry margin outright | | ≥ 15% | 4 | 0.5% | | Entry margin is 9.1% of deployed capital, so a 5% move does not liquidate the position outright. It removes roughly half the cushion, and the margin top-up exists to replace it. The 5% row is not a liquidation count. **A realistic bad month.** No modelled month closed negative; the weakest was February 2026 at +0.08%, with funding at −14% and no depeg. Add a depeg plus a \~50 bps round-trip reprice on the basis leg and the month comes to −1.64% at a 1% discount, −2.45% at 2% and −4.91% at 5%. A bad month is dominated by depeg rather than by funding. ### Failure modes Funding compression parks Keystone. Perp-venue trouble triggers an oracle-divergence auto-pause and a permissionless emergency unwind. Margin falling below its floor opens de-levering to anyone, so it does not wait for the keeper. A depeg auto-pauses. Wind-down turns Keystone into a pro-rata USDC claim, and redemption works whether or not the team is present. ## IX. Position Where this sits against the other yield-bearing dollars, by what actually produces the yield: | | Yield source | Behaviour when funding dies | Transparency | Venues | | -------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------ | ------------------------------------------------ | | **ksUSD** | **Staking and funding**, plus lending | Parks at the lending floor | Fully on-chain | Phoenix, Kamino, Jito (Solana-native) | | Hylo (hyUSD) | LST staking across the whole collateral pool, financed by xSOL | Unaffected by funding; tracks leveraged-SOL demand and rebalancing cost | On-chain | LST issuers + its own xSOL tranche and Earn Pool | | Ethena (sUSDe) | Delta-hedged perp funding | Yield follows funding down | Off-chain CEX, attested | CEXs + custodians | | MakerDAO / Sky | Stability fees + RWA/savings | Unaffected; tracks rates instead | On-chain + off-chain RWA | RWA counterparties | | Perena (USD\*) | Swap fees + stable yields | Tracks volume instead | On-chain | Solana AMM/DEX | **Hylo (hyUSD) is the closest Solana-native design, and it out-yields this one today:** ≈9.7% against 7.19% net here. It overcollateralises hyUSD with a basket of LSTs and issues xSOL, a junior tranche that absorbs SOL's volatility so hyUSD can hold its peg, and its savings token earns on the whole pool because xSOL and unstaked holders forgo their share. Both designs are claims on the same engine: Solana staking pays both. Hylo levers it through its tranche; Keystone hedges it with a perp. That rate is a participation ratio rather than a spread, so it converges downward as the product grows — toward the collateral ratio times the LST yield, which at Hylo's 150% target puts it at 9.5–10.5%. It has already made most of that move: 52.4% in Q1 2026, 9.7% the quarter after. The difference that outlasts the rate gap is that **Keystone has a cash state and Hylo does not**. When the trade stops paying, this parks in USDC lending, while Hylo's V2 reaches neutrality by charging rebalance subsidies to its own savers in exactly the drawdowns they bought the token to sit out. Full teardown, including eHYUSD: [Hylo comparison](/how-it-works/whitepaper/hylo.md). Ethena showed there is real demand for a yield-bearing dollar, and showed what happens when the one source of that yield compresses. The answer here is a different engine, Solana staking, and a cash state to fall back on when funding turns. The longer goal is dollar yield that comes from the market it lives on, and can be checked against it. *Simulated performance does not predict future results.* ¹ *Ethena figures are directional, from public dashboards over 2025–2026.* *** [app.keystonefi.xyz](https://app.keystonefi.xyz) · [docs.keystonefi.xyz](https://docs.keystonefi.xyz) · *Simulated figures only. Not investment advice.* *** ## Related * [Strategy & Modes](/how-it-works/strategy-and-modes.md) — the two modes, the funding threshold, and the switch * [What can go wrong](/start-here/volatility-risk-management.md) — drawdown guard, slippage bounds, depeg and staleness guards * [Historical Simulation](/how-it-works/strategy-and-modes/historical-simulation.md) — the backtest behind the headline numbers * [Fees](/start-here/fees.md) — HWM math and the hurdle ratchet * [NAV & Share Pricing](/how-it-works/strategy-and-modes/nav-calculation.md) — how a share is priced * [Security Model](/reference/security.md) — oracle, authority, and permissionless paths